# Kibana AI integration on Definable

> Kibana is a visualization and analytics platform for Elasticsearch, offering dashboards, data exploration, and monitoring capabilities for gaining insights from data

## What this connects

Kibana is a visualization and analytics platform for Elasticsearch, offering dashboards, data exploration, and monitoring capabilities for gaining insights from data

Vendor: https://www.elastic.co/kibana

## Tools available

**47** tools available. First 12:

- `KIBANA_DELETE_ALERTING_RULES` — Delete Alerting Rule — Tool to delete an alerting rule in Kibana. Use when you need to remove a specific alerting rule by its ID.
- `KIBANA_DELETE_CONNECTORS` — Delete Connector — Tool to delete a connector in Kibana. Use when you need to remove an existing connector.
- `KIBANA_DELETE_FLEET_OUTPUT` — Delete Fleet Output — Tool to delete a specific output configuration in Kibana Fleet. Use when you need to remove an existing output by its ID.
- `KIBANA_DELETE_FLEET_PROXY` — Delete Fleet Proxy — Deletes a Fleet proxy configuration by its unique identifier. Fleet proxies enable agents to communicate through proxy servers. Use this action to remove proxy configurations that are no longer needed. The proxy must not be in use by any agent policies or outputs before deletion. Requires 'fleet-settings-all' privileges in Kibana.
- `KIBANA_DELETE_LIST` — Delete List — Deletes a list. Use when you want to delete a list by its ID.
- `KIBANA_DELETE_OSQUERY_SAVED_QUERIES` — Delete Osquery Saved Query — Delete a saved Osquery query by its saved object ID. Use this to remove a specific Osquery saved query from Kibana. IMPORTANT: This action requires the 'saved_object_id' (UUID format), not the custom 'id' field. You can obtain the saved_object_id by listing queries first or from the response when creating a query.
- `KIBANA_DELETE_SAVED_OBJECTS` — Delete Saved Object — Tool to delete a saved object in Kibana. Use when you need to remove a specific saved object like a visualization or dashboard.
- `KIBANA_FIND_ALERTS` — Find Kibana Alerts — Tool to find and/or aggregate detection alerts in Kibana. Use this to retrieve a list of alerts, optionally filtering them with a query and performing aggregations.
- `KIBANA_GET_ACTION_TYPES` — Get Action Types — Retrieves all available connector types (actions) in Kibana. Connector types (also called action types) are integrations like Slack, Email, Webhook, ServiceNow, etc. that can be used with alerting rules, cases, and workflows. Use this to discover which connector types are available and their requirements (license, features) before creating a new connector instance. Returns detailed information about each connector type including: - ID (e.g., '.slack', '.email', '.webhook') - Display name and enabled status - License requirements (basic, gold, platinum, enterprise) - Supported features (alerting, cases, workflows, etc.) - Configuration and deprecation status
- `KIBANA_GET_ALERTING_RULES` — Get Alerting Rules — Tool to retrieve a list of alerting rules in Kibana. Use when you need to get a paginated set of rules based on specified conditions.
- `KIBANA_GET_ALERT_TYPES` — Get Rule Types — Retrieves available rule types (alert types) in Kibana. Returns comprehensive metadata about each rule type including: - Available action groups and variables for action templates - License requirements and authorization details - Category (management, observability, securitySolution) - Configuration options like auto-recovery and timeout settings Use this to discover what types of alerting rules can be created in your Kibana instance, such as Elasticsearch query alerts, index threshold alerts, machine learning anomaly detection, and security detection rules.
- `KIBANA_GET_CASES` — Get Cases — Tool to retrieve a list of cases in Kibana. Use when you need to find or list existing security or operational cases, potentially filtering by various attributes like status, assignee, or severity.

## Auth

Auth schemes: `API_KEY`, `BASIC`.

## How agents use Kibana

Inside a Definable workflow, Kibana is one of the tools the **Distributor specialist** can call. Example coordination patterns:

- **Researcher → Kibana** — the Researcher (GPT-5.5) pulls context from Kibana (records, threads, documents), synthesises findings, and briefs the rest of the team.
- **Writer → Distributor → Kibana** — the Writer (Claude Opus 4.7) drafts copy in brand voice, the Verifier passes it, then the Distributor writes the result into Kibana (create record, post message, draft email).
- **Designer / Engineer → Distributor → Kibana** — the Designer ships an asset or the Engineer ships a code change, the Distributor delivers it via Kibana (attach file, open PR comment, post status).

The Verifier checks every Kibana call. On rate limit, schema drift, or auth refresh it self-heals and retries — the workflow completes without manual intervention.

## Categories

- analytics — https://definable.ai/apps/category/analytics/
- dashboards — https://definable.ai/apps/category/dashboards/

## Related

- HTML page: https://definable.ai/apps/kibana/
- Same category (analytics): https://definable.ai/apps/category/analytics/
- All integrations: https://definable.ai/apps/
- Workflow (multi-agent loop): https://definable.ai/workflow/
- Apps llms.txt index: https://definable.ai/llms-apps.txt